Which SIEM platforms have a T1680 detection rule?

df00tech provides T1680 (Local Storage Discovery) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Local Storage Discovery (T1680)?

Detecting Local Storage Discovery requires the following data sources: Microsoft Defender for Endpoint.

What severity and confidence is the T1680 detection?

The T1680 detection is rated medium severity with medium confidence.

What are common false positives for T1680?

Common false positives for T1680 include: Backup agents (Veeam, Commvault, Veritas) routinely enumerate disk volumes before backup operations; System administration scripts and IT automation tools (Ansible, Chef, Puppet) checking disk capacity for health monitoring; Windows disk cleanup utilities and OS maintenance tasks invoking fsutil or wmic for storage information.

T1680 Microsoft Sentinel · KQL

Detect Local Storage Discovery in Microsoft Sentinel

This detection identifies adversary attempts to enumerate local drives, disks, volumes, and storage attributes across Windows, Linux, macOS, and ESXi platforms. Attackers use tools such as wmic logicaldisk, Get-PSDrive, lsblk, fdisk, diskutil, esxcli, and cloud CLI commands to gather disk size, free space, volume serial numbers, and partition layouts. Storage discovery is a critical precursor to ransomware encryption (to identify all encryptable volumes), lateral movement targeting network shares, and direct volume access attacks. Groups like TeamTNT and malware families including Cuba ransomware and ZeroCleare have demonstrated this behavior in production incidents.

MITRE ATT&CK

Tactic: Discovery
Technique: T1680 Local Storage Discovery
Canonical reference: https://attack.mitre.org/techniques/T1680/

KQL Detection Query

Microsoft Sentinel (KQL)

kusto

let StorageDiscoveryPatterns = dynamic(["logicaldisk", "diskdrive", "win32_volume", "win32_logicaldisk"]);
let PSStorageCmdlets = dynamic(["Get-PSDrive", "Get-Disk", "Get-Volume", "Get-Partition", "Get-PhysicalDisk", "Get-StoragePool"]);
let LinuxStorageCmds = dynamic(["lsblk", "fdisk", "parted", "lshw", "blkid", "lvdisplay", "pvdisplay", "vgdisplay"]);
let CloudStorageCmds = dynamic(["describe-volumes", "describe-instances", "disks list", "disk list"]);
DeviceProcessEvents
| where TimeGenerated > ago(1h)
| where (
    (FileName =~ "wmic.exe" and ProcessCommandLine has_any (StorageDiscoveryPatterns))
    or (FileName =~ "wmic.exe" and ProcessCommandLine has "volume" and ProcessCommandLine has "get")
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any (PSStorageCmdlets))
    or (FileName =~ "diskpart.exe" and ProcessCommandLine has_any ("list disk", "list volume", "list partition"))
    or (FileName =~ "fsutil.exe" and ProcessCommandLine has "fsinfo")
    or (FileName =~ "mountvol.exe")
    or (FileName in~ ("lsblk", "fdisk", "parted", "lshw", "blkid", "df") and ProcessCommandLine has_any (LinuxStorageCmds))
    or (FileName =~ "diskutil" and (ProcessCommandLine has "list" or ProcessCommandLine has "info"))
    or (FileName =~ "system_profiler" and ProcessCommandLine has "SPStorageDataType")
    or (FileName =~ "esxcli" and ProcessCommandLine has "storage")
    or (FileName in~ ("aws", "gcloud", "az") and ProcessCommandLine has_any (CloudStorageCmds))
)
| where InitiatingProcessFileName !in~ ("msiexec.exe", "MsMpEng.exe", "svchost.exe", "services.exe")
| project TimeGenerated, DeviceName, AccountName, AccountDomain,
    FileName, ProcessCommandLine, FolderPath,
    InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName,
    ProcessId, InitiatingProcessId
| extend RiskIndicator = case(
    ProcessCommandLine has "wmic" and ProcessCommandLine has "logicaldisk", "WMIC LogicalDisk Enumeration",
    ProcessCommandLine has_any (PSStorageCmdlets), "PowerShell Storage Cmdlet",
    ProcessCommandLine has "diskpart", "DiskPart Storage Enumeration",
    ProcessCommandLine has "esxcli" and ProcessCommandLine has "storage", "ESXi Storage Enumeration",
    ProcessCommandLine has_any (CloudStorageCmds), "Cloud Volume Enumeration",
    "Generic Storage Discovery"
)
| order by TimeGenerated desc

medium severity medium confidence

Detects process execution patterns consistent with local storage enumeration across Windows (wmic logicaldisk, PowerShell Get-PSDrive/Get-Disk, diskpart, fsutil), Linux (lsblk, fdisk, parted, lshw), macOS (diskutil, system_profiler SPStorageDataType), ESXi (esxcli storage), and cloud CLI (aws describe-volumes, gcloud compute disks list, az disk list). Filters common system processes that legitimately invoke these utilities to reduce noise.

Data Sources

Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives & Tuning

Backup agents (Veeam, Commvault, Veritas) routinely enumerate disk volumes before backup operations
System administration scripts and IT automation tools (Ansible, Chef, Puppet) checking disk capacity for health monitoring
Windows disk cleanup utilities and OS maintenance tasks invoking fsutil or wmic for storage information
Cloud management platforms and orchestration tools (Terraform, Packer) enumerating volumes during provisioning
Storage monitoring agents and SIEM forwarders checking disk free space for alerting thresholds

Download portable Sigma rule (.yml)

Other platforms for T1680

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 6 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Windows WMIC LogicalDisk Enumeration
Expected signal: DeviceProcessEvents: FileName=wmic.exe, ProcessCommandLine contains 'logicaldisk get'. Security Event 4688 if process creation auditing enabled. Sysmon EventCode=1 with full command line.
Test 2PowerShell Storage Enumeration via Get-Disk and Get-Volume
Expected signal: DeviceProcessEvents: FileName=powershell.exe, ProcessCommandLine contains 'Get-Disk' and 'Get-Volume'. PowerShell Script Block Logging (Event 4104) will record the script block if enabled. Sysmon EventCode=1.
Test 3DiskPart Volume and Disk Listing
Expected signal: DeviceProcessEvents: FileName=diskpart.exe with /s flag and temp file path. DeviceFileEvents: temp script file creation in %TEMP%. Security Event 4688 or Sysmon EventCode=1.
Test 4Linux Block Device Enumeration
Expected signal: Syslog or auditd EXECVE records for lsblk, fdisk, df, blkid. auditd: type=EXECVE msg containing lsblk and fdisk arguments. bash history update.
Test 5ESXi Storage Enumeration via esxcli
Expected signal: ESXi shell.log (/var/log/shell.log): command execution entries for esxcli storage filesystem list and vim-cmd. Syslog entries if syslog forwarding is configured to a SIEM.
Test 6AWS Cloud Volume Discovery
Expected signal: AWS CloudTrail: DescribeVolumes and DescribeInstances API calls with sourceIPAddress, userIdentity.arn, and eventTime. CloudTrail log should appear in S3 bucket within 15 minutes.

Last updated: 2026-03-20 Research depth: deep

References (9)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1680 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Related Techniques

T1006Direct Volume Access T1486Data Encrypted for Impact T1083File and Directory Discovery T1057Process Discovery T1082System Information Discovery T1490Inhibit System Recovery T1059.001PowerShell T1059.003Windows Command Shell T1059.012Hypervisor CLI

Detect Local Storage Discovery in Microsoft Sentinel

MITRE ATT&CK

KQL Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1680

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Related Techniques

Same Tactic: Discovery

Popular Detections

MITRE ATT&CK

KQL Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1680

Testing Methodology

Unlock Pro Content

Related Detections

Related Techniques

Same Tactic: Discovery

Popular Detections

Get new detections in your inbox